customer asks how we arrange access for external suppliers or freelancers

Access for third parties falls under access policy, not under supply chain management

This question belongs to the organization's access policy, not to questions about suppliers themselves. The customer wants to know how you prevent a freelancer or external party from gaining more rights than necessary, and how you revoke that access once the work is completed. Make that distinction yourself too: a question about the security requirements you impose on external parties concerns supply chain management, a question about how those parties themselves log in to your systems concerns access. Questionnaires often lump this together, but these are two different measures from Article 21(2) NIS2 and two different Annex A chapters in ISO 27001.

What is specifically asked: do you have a process for granting, modifying, and revoking access (onboarding and offboarding), do you work with temporary or expired accounts for external parties, and does the least privilege principle apply — access only to what is necessary, not to the entire network. If external parties gain remote access, it is often also asked whether multi-factor authentication is mandatory. If you have no separate policy for external parties, but fall back on general access management in which no distinction is made between your own employees and third parties, then "no" is the honest answer — a shared password or a permanently active account after completion of an assignment does not count as controlled access.

Where that appears in the directive and the standard

Article 21(2) NIS2 mentions access control policy and personnel security as two of the ten mandatory measures; ISO 27001 elaborates on this in Annex A under access control, with specific attention to access by third parties and its revocation at the end of the agreement.